CVE-2023-20175 — OS Command Injection in Cisco Identity Services Engine Software

CWE-78 — OS Command InjectionCWE-77 — Command Injection4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 73.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services Engine SoftwareCisco Identity Services Engine
Timeline
PublishedNov 1

Description

A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Read-only-level privileges or higher on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-333g-4p9h-pgjv: A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlyin↗2023-11-01
▶
CVEList
CVE-2023-20175: A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlyin↗2023-11-01
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Command Injection Vulnerabilities↗2023-11-01
▶
CVE-2023-20175 — OS Command Injection in Cisco | cvebase